A bank can perform many reviews and still miss an important risk—or test the same control repeatedly—when assurance work is planned in separate silos. Coordination creates a clearer view of coverage, but it must not turn independent challenge into shared ownership of management's controls.
The assurance map begins with risks and critical controls
Leaders identify material businesses, obligations, processes, systems, risks and controls, then connect them with the monitoring, testing, review or audit work expected during the planning period. Recent incidents, changes, complaints, losses and open issues help show where the risk view has shifted.
The map is more than a calendar of teams. It shows which objective each review addresses, who owns the underlying activity, what population or period is covered and where no credible evidence currently exists.
Each line keeps a distinct purpose
Business units own risks and controls and may perform supervision, quality checks and control self-assessment. Independent risk and compliance functions set frameworks, monitor exposure and provide challenge or testing according to their mandates. Internal audit gives the board independent assurance over governance, risk management and controls.
External audit, regulators, specialist reviews and service-organization reports can add evidence, but they do not automatically replace internal responsibilities. Clear charters and reporting lines prevent a control owner from treating another reviewer's work as ownership of the control.
Reliance depends on scope, competence and objectivity
Before one function relies on another's work, it evaluates the reviewer's qualifications and independence, the method and sample, evidence quality, period covered, issue handling and whether the work addresses the same objective. A favorable summary is not enough when the underlying scope or population differs.
Internal audit independently determines whether and how much reliance is appropriate under its standards and mandate. Coordination can reduce unnecessary duplication, but management cannot negotiate away audit coverage simply because a first- or second-line review exists.
Coverage follows risk rather than equal rotation
The plan directs deeper or more frequent work to higher-risk, rapidly changing or weakly controlled areas while maintaining reasonable coverage of the wider audit and compliance universe. Emerging risks and major transformations can require capacity that was not visible when the annual plan was approved.
Leaders identify gaps, overlaps, dependencies and resource constraints openly. Deferring a review is a governed decision with a documented risk view and alternative monitoring where appropriate—not an assumption that an untested area is sound because no adverse event has yet been reported.
Integrated reporting preserves separate judgments
Boards and senior management receive a coherent view of coverage, material findings, overdue actions and themes across functions. Reports distinguish management monitoring, second-line conclusions, internal-audit opinions and external observations so different levels of assurance are not blended into one reassuring average.
Functions share relevant facts and coordinate timing while retaining authority to disagree, escalate and set their own conclusions. The plan is refreshed when risk changes, and follow-up confirms that corrective action worked rather than allowing repeated reviews to substitute for resolution.
Read the primary material
Banking Explained prioritizes regulators, official publications and first-party announcements.